- Shipped
- September 25, 2026 at 3:10 PM UTC
- Author
- Kamo
- Commit
- 6da76a6
The email-route IngressRoute sends every path on an email.* host straight to EmailService, past the API gateway, so the gateway's carve-outs (master spec section 7 item 13) never applied there. /api/internal/** and /api/email/internal/** were reachable from the internet with only their shared secrets in the way, and Dovecot push (E7) and AI mailbox provisioning (E6) would have joined them. Every caller is in the cluster and uses kamowsemail-service directly. EmailIngressRouteTest holds every internal mapping behind the exclusions and checks that no public mapping falls under one.